ASN (Autonomous System Number)
An Autonomous System Number identifies a collection of IP address ranges under the control of a single organization (an Internet Service Provider, cloud provider, or enterprise). ASNs are used in threat intelligence to identify hosting providers commonly used by attackers.
An ASN is the number a network carries on the Internet’s routing table. Every IP address belongs to a prefix, every prefix is announced by exactly one autonomous system, and the ASN names that system: AS15169 is Google, AS16509 is Amazon, AS3215 is Orange. The number tells you who operates the network an address sits in, not who uses the address.
That is why it matters in threat intelligence. Abuse clusters by operator. A handful of systems announce a disproportionate share of phishing, malware hosting and scanning traffic, either because they sell to anyone or because they are built for it. Knowing the ASN of an address gives you the operator’s history before you know anything about the address itself.
The number also explains behaviour that looks contradictory at the address level. The same IP can be clean one month and hostile the next when a prefix is re-announced by a different system, so an IP verdict without its ASN is missing the context that decides whether the history still applies.
Example
Two addresses report identical scanning behaviour. One belongs to a residential ISP’s ASN, the other to a hosting system with a long abuse record. The second is blocked at the prefix level; the first is watched, because blocking a residential ASN denies service to its subscribers.
In isMalicious
Every IP lookup on isMalicious shows the ASN and the operator name in the report header, and the ASN page at /threat-intel/asn aggregates the reputation of the addresses a system announces, so an operator can be judged before any of its addresses is.
Frequently Asked Questions
What is ASN (Autonomous System Number)?
An Autonomous System Number identifies a collection of IP address ranges under the control of a single organization (an Internet Service Provider, cloud provider, or enterprise). ASNs are used in threat intelligence to identify hosting providers commonly used by attackers.
How is ASN (Autonomous System Number) related to IP Reputation?
ASN (Autonomous System Number) and IP Reputation are both key concepts in threat intelligence. IP reputation is a score or classification indicating whether an IP address has been associated with malicious activity. Factors include appearance on blocklists, volume of spam sent, history of port scanning, C2 hosting, and abuse reports.
Related Terms
IP Reputation
IP reputation is a score or classification indicating whether an IP address has been associated with malicious activity. Factors include appearance on blocklists, volume of spam sent, history of port scanning, C2 hosting, and abuse reports.
Blocklist (Denylist)
A blocklist is a list of IPs, domains, URLs, or file hashes known to be malicious. Firewalls, DNS resolvers, and email gateways use blocklists to automatically block traffic from known bad actors. Blocklists must be kept current to remain effective.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.